What’s Vulnerable › Vulnerabilities

CVE-2026-39924: Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-10-23
• Weakness: CWE-613

Description

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

Affected products

• Flarum Framework: before 1.8.16 — fixed in 1.8.16

How to fix

Upgrade to a fixed version: Flarum Framework 1.8.16. Check the vendor advisory for mitigations.

References

• https://github.com/flarum/framework/commit/5f080293a029d0d273eb9678d597c74ea86a3bcc
• https://github.com/flarum/framework/pull/4546
• https://github.com/flarum/framework/releases/tag/v1.8.16
• https://www.vulncheck.com/advisories/flarum-session-persistence-via-improper-access-token-revocation

Get alerted when CVE-2026-39924 or the next vulnerability affects your stack